Add CSRF tokens on appearance, settings, security
Expand disallowed PHP files in .htaccess
Add CSRF protection on themes actions.
Add CSRF protection for navigation.
Fix ThemesController test.
Don't save CSRF token as theme setting.
Add general method for using session CSRF token.
Add CSRF protection for files, items, collections
Add CSRF protection to plugins actions.
Kill notice in ElementForm on incomplete POSTs.
Use "token" instead of "hash"
Fix display of Csrf quasi-form
Fix tests for now-protected forms
Switch to session-based csrf form for manual use
Remove unused tag actions.
Token-ize the bulk of remaining admin actions

Covers element-sets, item-types, settings (api, search,
item-type-elements).
Token-ize tags ajax action.
Loosen timeouts on per-page tokens.
Use deletion popup for element sets.
Fix extra spacing on collections pagination.